Bot traffic makes up 49% of online activity, but 99% of bots unwanted

Nearly half of internet traffic comes from bots while 99% of bot traffic is unwanted, according to Fastly’s latest Threats Insights Report published Thursday.

Insights from trillions of requests to Fastly customers’ applications and APIs throughout January 2026 revealed that about 51% of traffic comes from humans and only 1% comes from verified bots with a known legitimate business purpose, such as search engine crawlers.

The remaining 48% comprises unverified bots that “provide no business value to websites,” according to Fastly, which can range from unwanted data scrapers to malicious bots scanning for vulnerabilities or attempting account takeover attacks.

Fastly warned that many of these unwanted bots declare false user agents to disguise themselves as trusted services, emphasizing the importance of other indicators such as behavior and originating network to distinguish between benign and malicious bots.

“The organizations that adapt won’t be the ones that simply block more or allow more. They’ll be the ones that make deliberate, granular decisions about who gets access to what, and why,” the researchers wrote in a blog post.

The Threats Insights Report also broke down the volumes of bot and human traffic going to cached versus origin content, finding that 47% of cached content requests come from bots compared with 60% of origin content requests.

While this generally reflects the indiscriminate nature of bots such as crawlers, scrapers and scanners when accessing content, it raised concerns about costs incurred when serving content to unwanted bots.

When it came to verified bot traffic, only 8% was found to come from AI services, although these bots can have an “outsized” impact due to the way the data they retrieve is incorporated into training data and AI responses.

Broken down by industry, the software- and platform-as-a-service (SaaS/PaaS) sector saw 22% more unwanted bot traffic, 21% less human traffic and 136% more AI bot activity, while the advertisement technology (AdTech) industry saw the highest amount of unwanted bot traffic — 33% more than the baseline.  

Fastly said the report indicated that companies need to move beyond simply blocking or allowing bot traffic and seek to distinguish between wanted and unwanted bots through signals such as behavior and origin.

The rising prevalence of unwanted bots was previously indicated in Imperva’s 2025 Bad Bot Report, which found that more than a third of all internet traffic in 2024 — 37% — came from malicious bots.